Microsoft Edge Chakra JIT - Escape Analysis Bug Exploit

Exploit for windows platform in category dos / poc / Escape analysis: https://en.wikipedia.org/wiki/Escapeanalysis Chakra fails to detect if "tmp" escapes the scope, allocates it to the stack. This may lead to dereference uninitialized stack values. PoC: / function opt let tmp = ; tmp0 = tmp;...

WordPress LearnDash 2.5.3 Plugin - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: WordPress LearnDash 2.5.3 Unauthenticated Arbitrary File Upload Date: 07-01-2018 Vendor Homepage: https://www.learndash.com/ Vendor Changelog: https://www.learndash.com/changelog/ Version: 2.5.3 Exploit Author: NinTechNet Author...

Wowonder CMS - Privilege Escalation Vulnerability

Exploit for php platform in category web applications Today I will explain an exploit of Privilege Escalation in Wowonder CMS. First we need firefox v56.0.2 or earlier and then download hackbar: https://addons.mozilla.org/es/firefox/addon/hackbar/ Note: If the bar does not appear, press F9 to mak...

Joomla Advertisement Board Classifieds 3.2.0 Shell Upload Vulnerability

Exploit for php platform in category web applications Title: Advertisement board Joomla classifieds extension 3.2.0 - Remote Shell Upload Vulnerability Credit: Bilal KARDADOU Vendor: http://ordasoft.com/ URL: http://ordasoft.com/advertisement-board-joomla-classifieds-extension Product:...

D3DGear 5.00 Build 2175 - Buffer Overflow Exploit

Exploit for windows platform in category dos / poc !/usr/bin/python Exploit Author: bzyo Twitter: @bzyo Exploit Title: D3DGear 5.00 Build 2175 - Buffer Overflow Date: 07-11-2017 Vulnerable Software: D3DGear 5.00 Build 2175 Vendor Homepage: http://www.d3dgear.com/ Version: 5.00 Build 2175 Software...

Apple macOS - IOHIDSystem Kernel ReadWrite

Apple macOS - IOHIDSystem Kernel ReadWrite Sources: https://siguza.github.io/IOHIDeous/ https://github.com/Siguza/IOHIDeous/ IOHIDeous A macOS kernel exploit based on an IOHIDFamily 0day. Write-up here: https://siguza.github.io/IOHIDeous/ Notice The prefetch timing attack I'm using for hid for so...

ALLMediaServer 0.95 - Buffer Overflow (Metasploit) Exploit

Exploit for windows platform in category remote exploits require 'msf/core' class Metasploit4 'ALLMediaServer 0.95 Buffer Overflow', 'Description' = %q This module exploits a stack buffer overflow in ALLMediaServer 0.95. The vulnerability is caused due to a boundary error within the handling of...

COMTREND ADSL Router CT-5367 - Remote Code Execution Exploit

Exploit for hardware platform in category remote exploits Exploit Title: Globalnet COMTREND ADSL Router CT-5367 Remote Code Execute Date: 11-12-2017 Exploit Author: TnMch Software Link : null Type : HardWare Risk of use : High Type to use : Remote 1. Description Any user can edit all users passwo...

Biometric Shift Employee Management System 3.0 - Local File Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title: Biometric Shift Employee Management System 3.0 - Local File Download Dork: N/A Date: 24.12.2017 Vendor Homepage: https://www.shiftsystems.net/ Software Link:...

phpMars 1.0.9 Cross Site Scripting Vulnerability

phpMars version 1.0.9 suffers from a cross site scripting vulnerability. Exploit Title: phpMars - Photos Social Network instagram clone - Cross Site Scripting Google Dork: N/A Date: 2017/20/12 Exploit Author: ShanoWeb Author Mail : MrdotNet2NetatGmaildotcom Vendor Homepage: http://grohsfabian.com...

Linux kernel < 4.10.15 - Race Condition Privilege Escalation Exploit

Exploit for linux platform in category local exploits PoC for CVE-2017-10661, triggers UAF with KASan enabled in kernel 4.10 / include include include include include include include include include include include include include include include include include define RACETIME 1000000 int fd; in...

Joomla JBcatalog Component - Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: Joomla Component JBcatalog - Arbitrary File Upload Google Dork: inurl:/components/comjbcatalog/ Date: 16 December 2017 Indonesia Exploit Author: AlHikam0x Tested on: Ubuntu Proof of Concept 1. Check Vulnerability...

Bus Booking Script 1.0 - txtname SQL Injection Vulnerability

Exploit for php platform in category web applications 0day.today 2018-01-01...

macOS / iOS - Kernel Double Free due to Incorrect API Usage in Flow Divert Socket Option Handling

Exploit for multiple platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1373 SOFLOWDIVERTTOKEN is a socket option on the SOLSOCKET layer. It's implemented by flowdiverttokensetstruct socket so, struct sockopt sopt in flowdivert.c. The relevant code is...

E-commerce MLM Software 1.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: E-commerce MLM Software 1.0 - SQL Injection Dork: N/A Date: 08.12.2017 Vendor Homepage: https://www.phpscriptsmall.com/ Software Link: https://www.phpscriptsmall.com/product/e-commerce-mlm/ Demo: http://74.124.215.220/advaemlm/...

Microsoft Edge Chakra CFG Bypass By Overwriting JavaScript Bytecode Vulnerability

Chakra suffers from a CFG bypass by overwriting JavaScript bytecode. Chakra: CFG bypass by overwriting JavaScript bytecode Assume an attacker has the ability to overwrite Chakra's bytecode, either through a read/write primitive or through an overflow type vulnerability. Let's take a look at the...

FS Facebook Clone - token SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: FS Facebook Clone - 'token' SQL Injection Date: 2017-12-06 Exploit Author: Dan° Vendor Homepage: https://fortunescripts.com/ Software Link: https://fortunescripts.com/product/facebook-clone/ Version: 2017-12-06 Tested on: Kali...

Microsoft Edge Chakra CFG Bypass Due To Bug In ServerFreeAllocation Vulnerability

Charka suffers from a CFG bypass due to a bug in ServerFreeAllocation. Chakra: CFG bypass due to a bug in ServerFreeAllocation CVE-2017-11874 Chakra JIT server exposes a ServerFreeAllocation method that can be used to free an existing JIT allocation for example when the corresponding function get...

Jobs2Careers / Coroflot Clone - SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Jobs2Careers / Coroflot Clone - SQL Injection Exploit Author: 8bitsec Vendor Homepage: http://www.i-netsolution.com/ Software Link: http://www.i-netsolution.com/product/jobs2careers-coroflot-jobs-clone-script/ Version: 30 Novemb...

Mac OS X High Sierra Root Privilege Escalation Exploit

This Metasploit module exploits a serious flaw in Mac OS X High Sierra. Any user can login with user "root", leaving an empty password. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mac OS X...